iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

90
votes
2answers
45k views

IPTABLES - Limit rate of a specific incoming IP

I do not wish to limit the rate of a specific service. My goals is to limit rate based solely on the incoming IP address. For example using a pseudo-rule: john.domain.local (192.168.1.100) can only ...
72
votes
5answers
203k views

How can I port forward with iptables?

I want connections coming in on ppp0 on port 8001 to be routed to 192.168.1.200 on eth0 on port 8080. I've got these two rules -A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination 192....
61
votes
8answers
113k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
58
votes
12answers
273k views

How to start/stop iptables on Ubuntu?

How can I start/stop the iptables service on Ubuntu? I have tried service iptables stop but it is giving "unrecognized service". Why is it doing so? Is there any other method?
56
votes
5answers
7k views

I accidentaly forbid SSH connection to a remote server… What's next?

Let's say it again, we all make mistakes, and I have just made one. A brief history: I was doing some stuff on a VPS (Debian) I'm renting, when I noticed some strange behaviour. Using the netstat ...
46
votes
5answers
5k views

Why is tampering with the TTL of IP dangerous?

I've been reading the iptables man-page (light bedtime reading) and i came across the 'TTL' target, but it warns: Setting or incrementing the TTL field can potentially be very dangerous and ...
45
votes
5answers
38k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
44
votes
15answers
20k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
38
votes
8answers
35k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two....
37
votes
4answers
56k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
36
votes
9answers
23k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
35
votes
3answers
15k views

Iptables, what's the difference between -m state and -m conntrack?

What's the practical difference between: iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Which one is ...
33
votes
6answers
13k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
33
votes
4answers
51k views

How to reload default Mac OSX routing table without rebooting

Greetings, I'm using vpnc for a VPN client. I'm also doing some tricky things with route to make sure I can still access my local network, etc. etc. (the particulars here are not very important). ...
31
votes
3answers
33k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \ --dport 443 -...
31
votes
6answers
65k views

iptables equivalent for mac os x

I want to forward requests from 192.168.99.100:80 to 127.0.0.1:8000. This is how I'd do it in linux using iptables: iptables -t nat -A OUTPUT -p tcp --dport 80 -d 192.168.99.100 -j DNAT --to-...
28
votes
6answers
7k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
27
votes
2answers
27k views

IPTables only allow localhost access

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over. I have a service that I only want to allow ...
26
votes
1answer
1k views

Minimal rate and default class problem for HTB

I have some doubts about a HTB structure I'm using. My aim is to limit the download and upload speed of users in a local network. Each user of the network has a personal list of domains with a down ...
24
votes
1answer
3k views

How can I block all traffic *except* Tor?

On a Linux system, is there a way to block all in and outbound traffic unless it passes through the Tor network. This includes any form of IP communication, not just TCP connections. For example I ...
22
votes
4answers
31k views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
22
votes
4answers
25k views

How do you PREPEND an iptables rather than APPEND?

Pretty basic question.. How do you PREPEND an iptables rather than APPEND? I have DROP statements at the bottom of my rules. I have software to add new rules but adding rules after DROP statements ...
21
votes
2answers
58k views

Allowing FTP with IPTables

My current scenario involves allowing various rules, but I need ftp to be accessible from anywhere. The OS is Cent 5 and I am using VSFTPD. I can't seem to get the syntax correct. All other rules ...
20
votes
3answers
11k views

Where does UFW (uncomplicated firewall) save command-line rules to?

You add a rule like this: ufw allow 22/tcp The rule is saved, and is applied even after reboot. But it's not written anywhere in /etc/ufw. Where is it saved to? (Ubuntu, using ufw as pre-installed.)...
20
votes
7answers
33k views

Force local IP traffic to an external interface

I have a machine with several interfaces that I can configure as I want, for instance: eth1: 192.168.1.1 eth2: 192.168.2.2 I would like to forward all the traffic sent to one of these local ...
20
votes
1answer
7k views

What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?

I have noticed that there is docker-proxy process running for each published port. What is the purpose of this process? Why is a user space tcp proxy needed for this? $ ps -Af | grep proxy root ...
19
votes
3answers
42k views

What is the correct way to open a range of ports in iptables

I have come across articles advising for the following: iptables -A INPUT -p tcp 1000:2000 -j ACCEPT And others stating that the above will not work and iptables only supports multiple port ...
19
votes
6answers
8k views

Use IPtables or null route for blacklisting about 1 million IP addresses?

I've come across a situation where a client needs to blacklist a set of just under 1 million individual IP addresses (no subnets), and network performance is a concern. While I would conjecture that ...
18
votes
3answers
46k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
18
votes
2answers
49k views

How to do the port forwarding from one ip to another ip in same network?

I would like do some NAT in iptables. So that, all the packets coming to 192.168.12.87 and port 80 will be forwarded to 192.168.12.77 port 80. How to do this with iptables? Or Any other ways to ...
17
votes
2answers
5k views

iptables -L pretty slow. Is this normal?

Quick question but Gooling has not revealed an answer. When I do iptables -L, it seems to lag on displaying items in where I have limited the source to internal ips 192.168.0.0/24 The whole listing ...
17
votes
6answers
45k views

Delete a iptables chain with its all rules

I have a chain appended with many rules like: > :i_XXXXX_i - [0:0] > -A INPUT -s 282.202.203.83/32 -j i_XXXXX_i > -A INPUT -s 222.202.62.253/32 -j i_XXXXX_i > -A INPUT -s 222.202.60.62/...
17
votes
2answers
46k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
17
votes
1answer
23k views

Why does a Docker container running a server expose port to the outside world even though said port is blocked by iptables?

I'm having a problem with MySQL running inside a Docker container. My testing image is built from the following Dockerfile: # See: https://index.docker.io/u/brice/mysql/ FROM ubuntu:12.10 MAINTAINER ...
17
votes
2answers
12k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
16
votes
11answers
61k views

Using Linux IPTables, How to block torrents or any P2P protocols?

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
16
votes
2answers
38k views

Does traceroute use UDP or ICMP or both?

When I do a trace on the www.google.com domain from my laptop, am I using icmp or udp ? I thought it was icmp type 11 but while searching for something else I came across rules where icmp type 30 was ...
16
votes
1answer
20k views

Can I use ufw to setup a port forward?

Im currently using ufw to enforce some basic firewall rules. Is it possible to also use ufw to do port forwarding? Specifically im wanting to forward incoming traffic to my server (same machine ...
16
votes
1answer
28k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --...
15
votes
6answers
2k views

Will blocking all connections outside of the US, aside from port 80 cause a high server load?

Like most servers (I assume), we have people trying to brute force our services 24/7. I have cpHulk blacklist their IP's, but it seems like it'd be better if they didn't get that far in the first ...
15
votes
3answers
39k views

Linux/iptables: best way to clear all rules, leaving anything open

Currently have this snippet: iptables -F // flush all chains iptables -t nat -F iptables -t mangle -F iptables -X // delete all chains Is there a possibility that some impervious rule will stay ...
15
votes
3answers
13k views

Iptables management with ansible in huge environment

What is the best way to manage iptables from one point and have the ability to edit something on local server. We need to add some rules centralized on all servers, but we have specific servers with ...
15
votes
3answers
10k views

How to turn iptables stateless?

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I ...
14
votes
6answers
33k views

iptables multiple source IPs

I'd like to create a single rule in iptables (if possible) that uses multiple source IP addresses. Is this possible?
14
votes
4answers
49k views

Centos 7 save iptables settings

Problem: iptables resets to default settings after server reboot. I'm trying to set rule like this: iptables -I INPUT -p tcp --dport 3000 -j ACCEPT after that I do: service iptables save and it ...
14
votes
5answers
44k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
14
votes
3answers
674 views

What are the IPV6 reserved address spaces?

I'm converting my good old IPV4 based iptables firewall script and would like to substitute the CLASS A/B/C/D/E reserved address spaces to the ones found in IPV6. My goal is to deny any packets that ...
14
votes
2answers
2k views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
14
votes
3answers
1k views

Debugging iptables and common firewall pitfalls?

This is a proposed Canonical Question about understanding and debugging the software firewall on Linux systems. In response to EEAA's answer and @Shog's comment that we need a suitable canonical ...
14
votes
4answers
42k views

iptables - Target to route packet to specific interface?

My home server has two main interfaces, eth1 (a standard internet connection) and tun0 (an OpenVPN tunnel). I'd like to use iptables to force all packets generated by a local process owned by UID ...